OVHcloud vs Hetzner Email Servers: 2027 Antispam Policies, Anti-DDoS & IP Subnet Economics
Published by Fred Dawson • Senior Deliverability Systems Architect • 18 min read
When engineering dedicated bare-metal email infrastructure in Europe, the two dominant hosting providers are OVHcloud (France, Canada, Germany) and Hetzner Online (Germany, Finland). While both provide unmetered high-bandwidth dedicated hardware at 70% to 80% lower costs than AWS or Azure, their antispam enforcement mechanisms, IP subnet portability, and Anti-DDoS network policies diverge significantly. This technical guide examines how OVH’s VAC honeypot network and failover IP architecture compare with Hetzner’s Robot abuse escalation and clean CIDR subnet routing for high-volume MTA operations.
- 1. Antispam Policies & Automated Port 25 Null-Routing
- 2. IPv4 Allocation, Failover IPs & Subnet Portability
- 3. Anti-DDoS Architecture: OVH VAC vs Hetzner Arbor
- 4. Server Hardware, Water Cooling & Spool Performance
- 5. OVHcloud vs Hetzner Architectural Matrix
- 6. The AutoSMTP Deliverability Defense Advantage
1. Antispam Policies & Automated Port 25 Null-Routing
The single greatest risk for an unmanaged email infrastructure operator is unexpected outbound port blocking due to automated provider heuristics. Both OVHcloud and Hetzner enforce strict zero-tolerance policies against malicious spam, but their detection and mitigation pipelines are fundamentally different.
OVHcloud: Automated VAC Honeypot Interception
OVH inspects outbound port 25 traffic using deep packet inspection (DPI) heuristics integrated into their proprietary VAC anti-DDoS hardware. If an MTA sends emails hitting known external trap networks or triggers customer complaint spikes, OVH’s automated anti-spam bot immediately blocks outbound TCP port 25 on the specific IP within seconds. An automated ticket is opened, requiring manual unblock via the OVH API or dashboard once remediation is proved.
Hetzner: Human Abuse Ticket Escalation (24h SLA)
Hetzner generally relies on external abuse reports (such as Spamhaus, SpamCop, or destination ISP notifications). When an abuse report arrives, Hetzner does not instantly cut port 25 with an algorithmic firewall; instead, they issue an automated Abuse Ticket via Hetzner Robot giving the customer a 24-hour SLA to investigate and resolve the issue. If unacknowledged after 24 hours, the server is locked at the switch port.
Operational Takeaway for High-Volume Outbound
For commercial newsletter senders and transactional systems that occasionally experience list hygiene hiccups, Hetzner’s 24-hour grace period allows engineers to isolate the offending customer or campaign without taking down the entire corporate mail queue. On OVH, automated socket triggers can sever port 25 instantly in the middle of a major campaign blast.
2. IPv4 Allocation, Failover IPs & Subnet Portability
Building high-volume multi-IP MTA pools requires acquiring and routing contiguous blocks of IPv4 addresses. In this domain, OVHcloud and Hetzner offer contrasting network topologies:
OVHcloud Failover IPs & vRack: OVH allows dedicated server operators to attach up to 256 additional IPv4 addresses per server. These IPs are provisioned as “Additional IPs” (formerly Failover IPs). Using OVH’s private layer-2 vRack interconnect, these IP blocks can be routed dynamically between any dedicated server in the same or even across different European datacenters (e.g., from Gravelines to Roubaix or Strasbourg) in seconds via the OVH API. This makes active-active failover and disaster recovery exceptionally robust.
Hetzner Subnets & vSwitch: Hetzner provides additional single IPs or routed subnets (/29 for 8 IPs, /28 for 16 IPs, /27 for 32 IPs) via RIPE justification. Subnets on Hetzner are statically routed to the physical MAC address of the primary server. While Hetzner’s vSwitch allows VLAN clustering, moving a routed subnet to a standby server requires re-pointing the routing gateway in the Robot console, which can introduce minor BGP convergence propagation delays.
# OVH API: Re-routing a /28 subnet to standby PowerMTA Node in vRack
curl -X POST https://eu.api.ovh.com/1.0/ip/198.51.100.0%2F28/move \
-H "X-Ovh-Application: your_app_key" \
-d '{"routedTo": {"server": "ns3049182.ip-198-51-100.eu"}}'
# Instant layer-2 ARP re-advertisement across European datacenters
# Hetzner Robot API: Updating subnet routing gateway to backup server
curl -u user:pass https://robot-ws.your-server.de/subnet/203.0.113.0/route \
-d "target=ns2.your-backup-server.de"
# Triggers internal routing gateway update (typically propagates in 2-5 minutes)3. Anti-DDoS Architecture: OVH VAC vs Hetzner Arbor
Mail servers, MX relays, and inbound webhook listeners are frequent targets of volumetric SYN floods, DNS amplification, and TLS renegotiation attacks designed to exhaust file descriptors and crash postfix/MTA processes.
OVHcloud operates one of the world’s largest anti-DDoS scrubbing fabrics, known as VAC, with over 17 Tbps of global edge filtering capacity. VAC scrubs malicious traffic in real time without blackholing the IP, keeping SMTP inbound queues responsive even during 500+ Gbps DDoS attacks.
Hetzner employs enterprise Arbor and Juniper filtration systems. While extremely capable against standard volumetric floods, Hetzner is known to automatically null-route (BGP blackhole) individual IP addresses if an attack exceeds threshold mitigation limits to protect the wider datacenter spine, which can take an MX record offline until the attack subsides.
4. Server Hardware, Water Cooling & Spool Performance
| Evaluation Dimension | OVHcloud (Advance / Scale Line) | Hetzner (EX / AX Server Line) | MTA Production Verdict |
|---|---|---|---|
| Server Processors | Enterprise Intel Xeon Gold / AMD EPYC | Consumer & Enterprise AMD Ryzen 7/9, EPYC | Hetzner: Higher single-core IPC for fast DKIM signing |
| Cooling & Reliability | Proprietary water-cooled datacenter chassis | Forced-air server racks (Falkenstein/Helsinki) | OVH: Exceptional thermal stability under 100% load |
| Maximum IPv4 Count | Up to 256 IPs per machine with vRack mobility | Up to 64 IPs (Subnet /27 + single IPs per server) | OVH: Superior for massive multi-tenant IP pools |
| Abuse SLA Policy | Instant algorithmic Port 25 block by VAC bot | 24-hour manual ticket response window | Hetzner: Dramatically less risk of sudden false-positive drops |
| Base Server Cost | €75 – €160 / month | €45 – €95 / month | Hetzner: 30-40% cheaper hardware cost per compute unit |
ESP Cluster Topology: Pairing Hetzner Outbound with OVH Inbound
An enterprise transactional ESP sending 80M emails per month deployed a hybrid multi-cloud European architecture: they utilize a 4-node Hetzner AX52 cluster (AMD Ryzen 7 7700 with dual NVMe) for outbound SMTP transmission to benefit from 24-hour abuse ticket stability and blazing DKIM signing speeds, paired with a redundant 2-node OVH Scale cluster in France for inbound MX and webhook processing to capitalize on OVH’s 17 Tbps VAC anti-DDoS scrubbing shield.
Architectural Decision Framework
- Choose Hetzner If: You want maximum raw CPU/NVMe performance per euro, prefer human abuse notification workflows with 24-hour cure windows, and operate single-tenant or tightly vetted outbound queues.
- Choose OVHcloud If: You require more than 64 dedicated IPv4 addresses per chassis, need seamless layer-2 cross-datacenter IP mobility via vRack, or your MX servers are subject to aggressive DDoS attacks.
The AutoSMTP Deliverability Defense Advantage
Whether deploying on OVHcloud, Hetzner, or private enterprise datacenters, raw bare metal requires complex manual orchestration. AutoSMTP eliminates the operational friction: automatically provisioning hardened PowerMTA/KumoMTA instances, managing automated rDNS alignment, and buffering abuse notifications before they impact your mail server uptime.
Provisions fully licensed PowerMTA and KumoMTA clusters on enterprise bare-metal with dedicated IPv4 subnets and predictable flat pricing.
Monitors Google Postmaster spam ratios (<0.1%) and real-time ISP deferrals with algorithmic volume scaling across your entire IP pool.
RFC 5321 in-band 550 bounce suppression, automated Yahoo/Outlook Complaint Feedback Loops (CFL), and instant bad-IP eviction.
Pre-configured forward and reverse DNS (PTR) per IP, SPF CIDR alignment, 2048-bit DKIM rotation, and strict DMARC enforcement.
Deploy Hardened European Bare-Metal Infrastructure
Get unmetered high-throughput email delivery with enterprise automated IP warming and deliverability monitoring on dedicated servers.
Deploy Turnkey MTA Cluster →